Browser Policy Manager 0.9.5 Release Candidate Adds Comprehensive Multi-Language Documentation Portal
Browser Policy Manager (BPM) is approaching its 1.0.0 release as an open-source tool for preparing, validating, and exporting Firefox Enterprise policy profiles. The project allows administrators to work with policies not only as raw policies.json files but also through a profile library, step-by-step editor, settings catalog, comparison tools, and source editor.
Version 0.9.5 adds support for four current Firefox schema channels: Release 153, ESR 153.0, ESR 140.13, and ESR 115.38. For older supported ESR releases, BPM can suggest migration to ESR 153.0, generate a preview of changes, and apply the transformation only after explicit confirmation. Profiles remain unchanged if a plan is outdated, blocked, or fails validation.
Why dedicated documentation matters
Official Mozilla documentation covers policy syntax and semantics, yet daily administration raises different questions: which schema channel to select for a given browser fleet, where to locate a setting inside BPM, when to use the step-by-step editor versus full JSON, how to validate imported files, and how to map profiles to CIS recommendations without treating automation as verified benchmark compliance. The new documentation portal addresses these needs directly within the product.
The portal contains four families of guides available in six interface languages: English, Russian, German, Simplified Chinese, French, and Spanish. These include a user guide covering the profile library, comparison features, editors, import/export, and error recovery; a Firefox policies reference explaining differences between Release and ESR channels; a CIS settings guide with mappings, presets, merge order, and automation boundaries; and an administrator and DevOps guide covering source builds on Linux and Windows via WSL, API integration, and current production limitations.
Technical implementation
Documentation sources are written in DITA to support reusable structure, stable topic identifiers, multiple locales, and strict link checking. After validation of content, terminology, links, and completeness, a static artifact is generated that includes a manifest and UI target map. BPM serves this artifact at /help/ without pulling DITA tooling or Java into the runtime. Context-sensitive links open in a new tab, preserving the state of any active profile editor.
Search relies on pre-built static indexes per locale. Ranking prioritizes exact matches on policy identifiers and headings over fuzzy text matches, with limited tolerance for typos. Normalization rules, aliases, and test queries are maintained separately for each language to handle declension, CJK segmentation, and technical identifiers correctly.
Future RAG plans and localization quality
No RAG or generated answers are active in 0.9.5. Planned local assistant features will require verified source fragments, atomic updates after hash and coverage checks, and explicit refusal when no suitable evidence exists in the requested locale. The model will not be trained on documentation or user dialogs.
Localization goes beyond simple translation. Every language maintains its own topics, navigation maps, search strings, alt text, and screenshots. A matrix of 36 verified localized images supports key scenarios. The 0.9.5 documentation review passed 1,001 selected contracts covering locale completeness, terminology consistency, visible English text, links, navigation, search, screenshots, and interface connections.
Source code for Browser Policy Manager is available on GitHub. The official Mozilla Firefox administrator reference remains the authoritative source for policy syntax and behavior.
Related articles
Implementing 2FA Kubernetes Access via Gateway API, Dex and MULTIDIRECTORY
A Russian cybersecurity company replaced static kubeconfig files with corporate accounts and mandatory 2FA for its Talos Linux Kubernetes clusters. The solution routes all authentication through a single FQDN using NGINX Gateway Fabric, Dex as an OIDC provider connected to MULTIDIRECTORY via LDAP, and kube-oidc-proxy for token validation and impersonation. Groups stored in the directory are passed directly into RBAC bindings, eliminating manual certificate management. A lightweight Python service dynamically generates kubeconfig files that contain no secrets. The team documented several Gateway API migration pitfalls including namespace route restrictions and BackendTLSPolicy hostname validation. The approach keeps the entire configuration in Git and avoids modifying kube-apiserver flags.
Windows File System Tunneling Preserves Old File Metadata for Legacy Compatibility
Microsoft has clarified that Windows sometimes assigns creation dates from deleted files to new ones due to a long-standing mechanism called File System Tunneling. The feature keeps metadata in a short-term cache for about 15 seconds after a file is deleted or renamed. If a new file with the same name is created quickly in the same folder, it inherits the previous file's timestamps and short-to-long name mappings. This behavior exists to support safe saving patterns used by many applications and to maintain compatibility with old DOS-era 8.3 filename formats. The actual file content is never restored, only the metadata. The cache is temporary and clears over time, so the effect does not occur with files deleted long ago. The explanation came after users noticed unexpected dates in Windows Explorer and questioned whether it was a bug.
Amazon Confirms Irrecoverable Data Loss in UAE and Bahrain Data Centers After Drone Attacks
Amazon Web Services has officially confirmed that data stored in specific availability zones within its Middle East regions was permanently destroyed following physical attacks on data centers in the UAE and Bahrain. The incidents began on March 1 and continued through April and July, damaging infrastructure tied to AI development projects. In the UAE region mec1, only zone mec1-az2 was completely destroyed with no external backups, while mec1-az3 suffered severe damage and mec1-az1 remained operational but overloaded. All three zones in the Bahrain region me-south-1 were rendered inoperable. AWS had spent six months attempting recovery before issuing the final statement on September 15, 2026, and has advised customers to migrate workloads to unaffected regions. The event highlights growing risks to data from physical-world attacks beyond traditional network threats.
Bots Overload OT Commerce Store on OT Box, Spike Paid OTAPI Calls Mistaken for DDoS Attack
An online store running OT Commerce experienced CPU loads reaching 98-100% and a 6-7x increase in paid OTAPI calls over three days due to automated bot traffic rather than a traditional DDoS. The site owner had already deployed a paid anti-bot module on the VPS, yet behavioral bots continued to bypass protections and force expensive calls to the external OTAPI platform for product data from Taobao, Tmall, 1688 and other marketplaces. Traffic analysis after switching to the CRONARMOR WAF revealed that 41.9% of page requests were automated, with 99.3% of early-stage automation blocked before reaching the origin server. Only 0.5% were behavioral bots visible in analytics, while legitimate search crawlers accounted for 27,190 requests that were explicitly allowed. The WAF approach stopped requests at the reverse proxy layer, preventing PHP execution, database queries and OTAPI billing events on the origin. Post-deployment CPU dropped to single digits for most of the day, eliminating both performance issues and the anomalous rise in paid API usage.